Answer in brief
CVE-2026-63857 records a Unknown severity vulnerability in net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=23020f04932701d5c8363e60756f12b43b8ed752 <f670fa4b19ceddc6d215dda4997888ccba9bbc61 || >=23020f04932701d5c8363e60756f12b43b8ed752 <d78c8ab7bd84952e053d0c622b7fc1b4ad8a19a3 || >=23020f04932701d5c8363e60756f12b43b8ed752 <bde34e84edc8b5571fbde7e941e175a4293ee1eb | f670fa4b19ceddc6d215dda4997888ccba9bbc61, d78c8ab7bd84952e053d0c622b7fc1b4ad8a19a3, bde34e84edc8b5571fbde7e941e175a4293ee1eb |
| Linux/Linuxgeneric | 6.11 | Not reported |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() The transmit loop in airoha_dev_xmit() reads fragment address and length during its final iteration, when the loop index equals skb_shinfo(skb)->nr_frags, at which point the fragment data is uninitialized. While these values are never consumed, the read itself is unsafe and may trigger a page fault. Fix this by avoiding the fragment read on the last iteration. Additionally, move the skb pointer from the first to the last used packet descriptor, so that airoha_qdma_tx_napi_poll() defers freeing the skb until the final descriptor is processed.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-63857 records a Unknown severity vulnerability in net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=23020f04932701d5c8363e60756f12b43b8ed752 <f670fa4b19ceddc6d215dda4997888ccba9bbc61 || >=23020f04932701d5c8363e60756f12b43b8ed752 <d78c8ab7bd84952e053d0c622b7fc1b4ad8a19a3 || >=23020f04932701d5c8363e60756f12b43b8ed752 <bde34e84edc8b5571fbde7e941e175a4293ee1eb | f670fa4b19ceddc6d215dda4997888ccba9bbc61, d78c8ab7bd84952e053d0c622b7fc1b4ad8a19a3, bde34e84edc8b5571fbde7e941e175a4293ee1eb |
| Linux/Linuxgeneric | 6.11 | Not reported |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit() The transmit loop in airoha_dev_xmit() reads fragment address and length during its final iteration, when the loop index equals skb_shinfo(skb)->nr_frags, at which point the fragment data is uninitialized. While these values are never consumed, the read itself is unsafe and may trigger a page fault. Fix this by avoiding the fragment read on the last iteration. Additionally, move the skb pointer from the first to the last used packet descriptor, so that airoha_qdma_tx_napi_poll() defers freeing the skb until the final descriptor is processed.
Quoted source text, attributed separately from HOL analysis.